Skip to content
OpenAdvisories
Medium USN-4279-1 3 CVEs

php5, php7.0, php7.2, php7.3 vulnerabilities

Published Feb 17, 2020 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled certain scripts.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS.
(CVE-2015-9253)

It was discovered that PHP incorrectly handled certain inputs. An attacker
could possibly use this issue to expose sensitive information.
(CVE-2020-7059)

It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS
and Ubuntu 19.10. (CVE-2020-7060)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.33-0ubuntu0.16.04.11
Ubuntu · 18.04 LTS 18.04:LTS php7.2 7.2.24-0ubuntu0.18.04.3
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS php5 5.5.9+dfsg-1ubuntu4.29+esm10

Vulnerabilities 3

  • Medium 6.5
    CVE-2020-7059

    OOB read in php_strip_tags_ex

    When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to informa…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-7060

    global buffer-overflow in mbfl_filt_conv_big5_wchar

    When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buff…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Unscored —
    CVE-2015-9253

    An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master proc…

    php5 php7.0 php7.2 php7 Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2015-9253
  • report
    https://ubuntu.com/security/CVE-2020-7059
  • report
    https://ubuntu.com/security/CVE-2020-7060